Bring the Flutter app's dependencies up to latest stable

Split out from the free-day change only by sequence -- diet-guard's
pre-push CI mirror runs the freshness gate over --all-files, so these
were already blocking a push before that work started.

permission_handler 13.0.1 -> 13.0.2 and workmanager 0.10.9 -> 0.10.10
are patch bumps. very_good_analysis ^10.3.0 -> ^11.0.0 is the major one,
and it newly flags 8 async_return_with_no_await sites across the desktop
wrapper and the sync/Firebase services.

Each is now `return await`, not a suppression. The rule is right in every
one of these cases: without the await the future escapes the enclosing
async function, so a rejection surfaces at the caller with a stack trace
that no longer points at the code that made the call.
background_check_service.dart:33 is the clearest example -- its own
comment says the push "is retried with backoff rather than silently
dropped", which is only true if the failure happens inside the function.

Nothing in CI or pre-commit runs `flutter analyze`, so this would not
have failed anything. Leaving a newly-red analyzer for the next person to
find is how a repo stops being analyzable at all.

flutter analyze clean, 706 Flutter tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/lib/desktop/wrapper_server.dart

@@ -104,16 +104,16 @@ class WrapperServer {
       return;
     }
     if (path.startsWith(WrapperPaths.documents)) {
-      return _storedFile(
+      return await _storedFile(
         request,
         'documents',
         path.substring(WrapperPaths.documents.length),
       );
     }
     if (path == kSyncAccountPath) {
-      return _syncAccount(request);
+      return await _syncAccount(request);
     }
-    return _static(request, path);
+    return await _static(request, path);
   }
 
   /// Serves the shared sync account so a desktop install can self-provision.

app/lib/services/background_check_service.dart

@@ -30,7 +30,7 @@ void backgroundCheckCallbackDispatcher() {
     if (taskName == syncPushTaskName) {
       // Return the push's own success flag so a still-offline / failed push
       // is retried with backoff rather than silently dropped.
-      return backgroundSyncPush();
+      return await backgroundSyncPush();
     }
     if (taskName == backgroundCheckTaskName) {
       await checkAndNotify();

app/lib/services/document_store_indexeddb.dart

@@ -53,7 +53,7 @@ class IndexedDbDocumentStore implements DocumentStore {
     if (value is String) return value;
     // Empty IndexedDB: either a first run or a cleared profile. Recover from
     // the wrapper's disk copy rather than silently starting from nothing.
-    return _readMirror(name);
+    return await _readMirror(name);
   }
 
   @override

app/lib/services/firebase_client.dart

@@ -26,7 +26,7 @@ Future<FirebaseRestClient?> openFirebase() async {
     // turned one missing write into "syncs over GitHub and 401s forever":
     // the credential that actually authenticates was sitting in the keystore
     // the whole time, unused. Ask the store directly before giving up.
-    return _clientFromStoredSession();
+    return await _clientFromStoredSession();
   }
   try {
     return await firebaseClientFor(

app/lib/services/google_sign_in_backend.dart

@@ -75,7 +75,7 @@ Future<String?> googleIdToken({
   Future<String?> Function()? signInFn,
   String serverClientId = kServerClientId,
 }) async {
-  if (signInFn != null) return signInFn();
+  if (signInFn != null) return await signInFn();
   if (serverClientId.isEmpty) {
     // A build without --dart-define=GOOGLE_SERVER_CLIENT_ID would otherwise
     // fail inside the plugin with a far less obvious message.

app/lib/services/sync_state_factory_web.dart

@@ -23,5 +23,5 @@ class _PrefsPersistence implements LogPersistence {
 
   @override
   Future<void> write(String text) async =>
-      _prefs.setString(kSyncStateKey, text);
+      await _prefs.setString(kSyncStateKey, text);
 }

app/pubspec.lock

@@ -510,18 +510,18 @@ packages:
     dependency: "direct main"
     description:
       name: permission_handler
-      sha256: e7317eb2eb611d1bf0386b6b974be9c50449f975f19a90a7b8ea013550302b30
+      sha256: e6bcecadfe40df6b888141f23cbaf6ba6c3da49fb33f6ff887d060dd48544fbd
       url: "https://pub.dev"
     source: hosted
-    version: "13.0.1"
+    version: "13.0.2"
   permission_handler_android:
     dependency: transitive
     description:
       name: permission_handler_android
-      sha256: d7676c6fcf2f0b92537ec41476a6ead45a00b0d8bbb852395a6f9f33f49d6242
+      sha256: b1ce660f4d0dcaffdf2605a19544c129fb5adda4e6fd039992ae356c4e437039
       url: "https://pub.dev"
     source: hosted
-    version: "14.0.0"
+    version: "14.1.0"
   permission_handler_apple:
     dependency: transitive
     description:
@@ -836,10 +836,10 @@ packages:
     dependency: "direct dev"
     description:
       name: very_good_analysis
-      sha256: "481af67ab5877af20325251dc215a4ebac7666a1c8cf09198ffd457bc612b33d"
+      sha256: "0bd5eb8d6be76aa0d71e70cbdae6cac8f784f761170568e3c2214a6948c7f6d3"
       url: "https://pub.dev"
     source: hosted
-    version: "10.3.0"
+    version: "11.0.0"
   vm_service:
     dependency: transitive
     description:
@@ -868,26 +868,26 @@ packages:
     dependency: "direct main"
     description:
       name: workmanager
-      sha256: c2c7a3eb984cfcf5623308042fc8270e7e02f5021b34f491ffc0a1ec8e281d5c
+      sha256: "96b09a4a852ec487d29371f27031dab80ce2e260911e2dbe0f904951e22a3956"
       url: "https://pub.dev"
     source: hosted
-    version: "0.10.9"
+    version: "0.10.10"
   workmanager_android:
     dependency: transitive
     description:
       name: workmanager_android
-      sha256: "187d1d34864f57f9e388b33b88c001c494093c53679831a3dec2e8176e8829d1"
+      sha256: ffe8aa061885370c9363f7ae2d2196d31855217c58e7b15899d915d36c768c4a
       url: "https://pub.dev"
     source: hosted
-    version: "0.10.8"
+    version: "0.10.9"
   workmanager_apple:
     dependency: transitive
     description:
       name: workmanager_apple
-      sha256: "15558fb54415a010910c3529eaf8f61f94d23903dac620331895c472602d6f6e"
+      sha256: "9e0ca0b857df986b37ca964ffa3b21990e1bc0f7935356a9706b47e5b71a7524"
       url: "https://pub.dev"
     source: hosted
-    version: "0.9.10"
+    version: "0.9.11"
   workmanager_linux:
     dependency: transitive
     description:
@@ -900,10 +900,10 @@ packages:
     dependency: transitive
     description:
       name: workmanager_platform_interface
-      sha256: "378b392db15ee88cd878ab983d3a0b4b1e460cfbb0f096ff74fda2614b1ba172"
+      sha256: a1022dca1284d64ba8bbe046edc9089cc5158b3d0e2cf9f68c7cde2fbf89746c
       url: "https://pub.dev"
     source: hosted
-    version: "0.10.4"
+    version: "0.10.5"
   workmanager_web:
     dependency: transitive
     description:
@@ -937,5 +937,5 @@ packages:
     source: hosted
     version: "3.1.3"
 sdks:
-  dart: ">=3.12.2 <4.0.0"
+  dart: ">=3.13.0 <4.0.0"
   flutter: ">=3.44.0"

app/pubspec.yaml

@@ -2,7 +2,7 @@ name: diet_guard_app
 description: "Companion phone app for diet_guard: log meals on the go."
 publish_to: 'none'
 
-version: 1.0.77+1
+version: 1.0.78+1
 
 environment:
   sdk: ^3.12.2
@@ -31,7 +31,7 @@ dependencies:
   idb_shim: 2.9.8
   path: 1.9.1
   path_provider: 2.1.6
-  permission_handler: 13.0.1
+  permission_handler: 13.0.2
   shared_preferences: 2.5.5
 
   # Shared "Sync settings" screen (Firebase + optional local backup), reused
@@ -46,7 +46,7 @@ dependencies:
   url_launcher: 6.3.2
   uuid: 4.6.0
   web: 1.1.1
-  workmanager: 0.10.9
+  workmanager: 0.10.10
 
 dev_dependencies:
   # Generates the Android launcher icons from assets/icon/ (see
@@ -58,7 +58,7 @@ dev_dependencies:
   # freshness check cannot compare against anything.
   plugin_platform_interface: 2.1.8
   url_launcher_platform_interface: 2.3.2
-  very_good_analysis: ^10.3.0
+  very_good_analysis: ^11.0.0
 
 flutter:
   uses-material-design: true